From b5666fd4c358d6e35fae223c7c4f7904086de651 Mon Sep 17 00:00:00 2001
From: Monto <138862352+monto7926@users.noreply.github.com>
Date: Wed, 23 Aug 2023 18:27:19 +0200
Subject: [PATCH] fix: team availability shows only to the member owning it
 (#10738)

Co-authored-by: SMLukwiya <sundaymorganl@gmail.com>
---
 .../eventtype/EventAvailabilityTab.tsx        | 11 +++++++++-
 .../availability/schedule/get.handler.ts      | 21 ++++++++++++++++++-
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/apps/web/components/eventtype/EventAvailabilityTab.tsx b/apps/web/components/eventtype/EventAvailabilityTab.tsx
index 6bd5acf9c0..48e72eb349 100644
--- a/apps/web/components/eventtype/EventAvailabilityTab.tsx
+++ b/apps/web/components/eventtype/EventAvailabilityTab.tsx
@@ -138,7 +138,7 @@ const EventTypeScheduleDetails = memo(
             <Globe className="h-3.5 w-3.5 ltr:mr-2 rtl:ml-2" />
             {schedule?.timeZone || <SkeletonText className="block h-5 w-32" />}
           </span>
-          {!!schedule?.id && !schedule.isManaged && (
+          {!!schedule?.id && !schedule.isManaged && !schedule.readOnly && (
             <Button
               href={`/availability/${schedule.id}`}
               disabled={isLoading}
@@ -202,6 +202,15 @@ const EventTypeSchedule = ({ eventType }: { eventType: EventTypeSetup }) => {
           isManaged: false,
         });
       }
+      // We push the selected schedule from the event type if it's not part of the list response. This happens if the user is an admin but not the schedule owner.
+      else if (eventType.schedule && !schedules.find((schedule) => schedule.id === eventType.schedule)) {
+        options.push({
+          value: eventType.schedule,
+          label: eventType.scheduleName ?? t("default_schedule_name"),
+          isDefault: false,
+          isManaged: false,
+        });
+      }
 
       setOptions(options);
 
diff --git a/packages/trpc/server/routers/viewer/availability/schedule/get.handler.ts b/packages/trpc/server/routers/viewer/availability/schedule/get.handler.ts
index 8883246cf5..368b52c70a 100644
--- a/packages/trpc/server/routers/viewer/availability/schedule/get.handler.ts
+++ b/packages/trpc/server/routers/viewer/availability/schedule/get.handler.ts
@@ -30,13 +30,31 @@ export const getHandler = async ({ ctx, input }: GetOptions) => {
       name: true,
       availability: true,
       timeZone: true,
+      eventType: {
+        select: {
+          _count: true,
+          id: true,
+          eventName: true,
+          team: {
+            select: { members: { select: { userId: true } } },
+          },
+        },
+      },
     },
   });
-  if (!schedule || (schedule.userId !== user.id && !input.isManagedEventType)) {
+
+  const isCurrentUserPartOfTeam = schedule?.eventType.some((eventType) =>
+    eventType.team?.members.some((teamMember) => teamMember.userId === user.id)
+  );
+
+  const isCurrentUserOwner = schedule?.userId === user.id;
+
+  if (!schedule || (!isCurrentUserOwner && !isCurrentUserPartOfTeam)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
     });
   }
+
   const timeZone = schedule.timeZone || user.timeZone;
 
   const schedulesCount = await prisma.schedule.count({
@@ -93,5 +111,6 @@ export const getHandler = async ({ ctx, input }: GetOptions) => {
     }, [] as { ranges: TimeRange[] }[]),
     isDefault: !input.scheduleId || user.defaultScheduleId === schedule.id,
     isLastSchedule: schedulesCount <= 1,
+    readOnly: schedule.userId !== user.id && !input.isManagedEventType,
   };
 };